Update ChangeLog

[exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index f6529c6e2343fef5db868178e6efa90d27e8187b..4a2a04bb4eb53e721fe24fefaa5063a542e88d54 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -821,7 +821,7 @@ The following variables are likely to be useful depending on the event type:
 
 An example might look like:
 
 
 An example might look like:
 

-event_action = ${if = {msg:delivery}{$event_name} \
+event_action = ${if eq {msg:delivery}{$event_name} \

 {${lookup pgsql {SELECT * FROM record_Delivery( \
     '${quote_pgsql:$sender_address_domain}',\
     '${quote_pgsql:${lc:$sender_address_local_part}}', \
 {${lookup pgsql {SELECT * FROM record_Delivery( \
     '${quote_pgsql:$sender_address_domain}',\
     '${quote_pgsql:${lc:$sender_address_local_part}}', \


@@ -1173,7 +1173,7 @@ component FQDN).
 The equivalent check on the server for client certificates is not
 implemented.  At least one major email provider is using a client
 certificate which fails this check.  They do not retry either without
 The equivalent check on the server for client certificates is not
 implemented.  At least one major email provider is using a client
 certificate which fails this check.  They do not retry either without

-hte client certificate or in clear.
+the client certificate or in clear.

 
 It is possible to duplicate the effect of this checking by
 creative use of Events.
 
 It is possible to duplicate the effect of this checking by
 creative use of Events.


@@ -1302,12 +1302,13 @@ MX, A and TLSA records.
 
 A TLSA lookup will be done if either of the above options match
 and the host-lookup succeded using dnssec.
 
 A TLSA lookup will be done if either of the above options match
 and the host-lookup succeded using dnssec.

-If the TLSA lookup succeeds, a TLS connection will be required
-for the host.
+If a TLSA lookup is done and succeeds, a DANE-verified TLS connection
+will be required for the host.

 
 (TODO: specify when fallback happens vs. when the host is not used)
 
 
 (TODO: specify when fallback happens vs. when the host is not used)
 

-If dane is in use the following transport options are ignored:
+If DANE is requested and useable (see above) the following transport
+options are ignored:

   hosts_require_tls
   tls_verify_hosts
   tls_try_verify_hosts
   hosts_require_tls
   tls_verify_hosts
   tls_try_verify_hosts


@@ -1315,6 +1316,10 @@ If dane is in use the following transport options are ignored:
   tls_crl
   tls_verify_cert_hostnames
 
   tls_crl
   tls_verify_cert_hostnames
 

+If DANE is not usable, whether requested or not, and CA-anchored
+verification evaluation is wanted, the above variables should be set
+appropriately.
+

 Currently dnssec_request_domains must be active (need to think about that)
 and dnssec_require_domains is ignored.
 
 Currently dnssec_request_domains must be active (need to think about that)
 and dnssec_require_domains is ignored.